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2012 


In accordance with my appointment by the Texas Secretary of State as a voting system examiner 
under Tex. Elec. Code Ann. § 122.067(a) & (b) (Vernon 2011), I present my report on the 
voting system examination done on August 22 and 23, 2012 in the offices of the Texas Secretary 
of State located at the Thomas Jefferson Rusk Office Building, 208 E. 10th Street, Austin, Texas 
78701. 

The system examined, known as the Assure 1.3 Voting System ("the system"), was presented by 
Dominion Voting Systems, Inc. ("Dominion") of Denver, Colorado. 

According to the Eorm 100 filed with the office of the Texas Secretary of State, the system 
presented by Dominion for examination consists of the following: 



Component Submitted for Certification 

Version/Eirmware # 

Previous Texas 
Certification Date 

1 

GEMS 

1.21.6 

7/6/2006 

2 

AccuVote-OS (Precinct 

Count) 

1.96.14 

7/6/2006 

3 

AccuVote-OS (Central 

Count) 

2.0.15 

7/6/2006 

4 

AccuVote-TSX/TS 

BallotStation 

4.7.10 

7/6/2006 

5 

TSX WinCE 

410.3.10 

7/6/2006 

6 

TS WinCE 

300.3.5 

7/6/2006 

7 

TSX/TS Bootloader 

1.3.11 

7/6/2006 

8 

Key Card Tool 

4.7.8 

7/6/2006 

9 

ABasic 

2.2.5 

7/6/2006 

10 

Voter Card Encoder 

1.3.3 

7/6/2006 



11 

VC Programmer 

4.7.8 

7/6/2006 

12 

Cardwriter 

1.1.6 

7/6/2006 

13 

PCS Central Count 

2.2.5 

None 

14 

Assure Security Manager 

1.2.5 

None 


In brief summary, for the reasons outlined below, I am unable to recommend the system for 
approval under Tex. Elec. Code Ann. § 122.031(a) (Vernon 2011) and 1 T.A.C. § 81.57(a) & 
(b) by the Texas Secretary of State at the present time. 

Standards for Approval or Certification 

The standards a voting system must meet for approval are set forth in Tex. Elec. Code Ann. §§ 
122.001(a)-(c),^ 122.032,^ 122.033,^ and 122.0331^ (Vernon 2011). Additionally, as required by 
the federal Help America Vote Act of 2002 ("HAVA") and Tex. Elec. Code Ann. § 61.012 
(Vernon 2011), a voting system must comply with the accessibility requirements listed in 1 
T.A.C. § 81.57(a) & (b) (graphics omitted). General information on and forms relating to the 
Texas voting system certification process can be found at 
http ://w w w. SOS . state. tx. us/elections/laws/generalinfo. shtml . 

Previous Approval or Certification 

With two exceptions, the last approval or certification by the Texas Secretary of State of the 
products (including firmware and software) now offered by Dominion (but previously presented 
by Diebold Election Systems, Inc.) was in July 2006. The two exceptions are the PCS Central 
Count and Assure Security Manager, which are offered for approval or certification here for the 
first time. Dominion has made two changes to the products offered here from the previously 
approved or certified versions. The first is known as the Assure 1.2 (which was not presented for 
certification in Texas). Assure 1.2 modified all products previously certified in Texas. The 
second known as the Assure 1.3 modified only three products previously modified by Assure 
1.2, which are being presented for certification in Texas: GEMS (including ABasic), AccuVote- 
OS PC, and BallotStation (the software application for use on the two accessible DRE units, the 
AccuVote-TS R6 and AccuVote-TSX). Eor purposes of this examination, it is my understanding 
that the Assure 1.3 Voting System includes the Assure 1.2 Voting System changes to the extent it 
changed the products which are presented for certification here. 

Reasons not to Approve or Certify System at this Time 

1. AccuVote-TS R6 and AccuVote-TSX. 

The Assure 1.3 Product Overview Guide dated May 7, 2012 represents that these two touch 
screen devices support optional hardware that allows visually impaired or physically challenged 
voters to vote independently. It should be noted, however, that the two devices, referred to 
collectively in the material presented by Dominion as "AccuVote-TS/X," do not physically 
resemble each other nor was it clear that both employ the same "disabled access" hardware. 
More importantly, there is nothing in either the documentation submitted in advance of the 
examination by Dominion or information (verbal or written) provided by Dominion at the 
examination itself that demonstrates that the AccuVote-TS R6 and AccuVote-TSX devices 




presented for the examination comply with the accessibility standards set forth in 1 T.A.C. § 
81.57(a) &(b). 

I suggest that if Dominion seeks approval/certification again of the AccuVote-TS R6 and 
AccuVote-TSX and their associated "BallotStation" software that it document in writing and 
with diagrams, as appropriate, to the Texas Secretary of State in advance of any subsequent 
examination how these devices meet the accessibility standards and that it confirm with a 
physical demonstration at the examination that the particular devices being examined comply 
with accessibility standards. 

The following comment applies not only to the AccuVote-TS R6 and AccuVote-TSX, but to the 
system as a whole presented for examination. Prior to the dates of the examination 
(approximately 45 days before). Dominion submitted to the Texas Secretary of State's office 
thousands of pages in hard copy and electronically covering Assure 1.3 and Assure 1.2. In 
addition, on August 22, during the examination. Dominion provided a DVD with additional 
Assure 1.2 and Assure 1.3 User Documentation and Release Notes. In a five-page document that 
accompanied the pre-examination submission of all these pages, entitled "Change Summary for 
Assure 1.3 for Texas State Certification," Dominion stated: 

Below is listed the change summary for Dominion Voting Systems' 

Assure 1.3 system. These changes are modifications made to the 
Assure 1.2 system. To review the incremental changes made to the 
Assure 1.2 system from the previously certified version, please 
review the System Change Notes for each product in the Assure 
1.2 TDP documentation. 

The Change Summary also stated that although the AccuVote-OSX, AUTOMark, AIMS, and 
AccuView Printer Module products are part of the Assure 1.3 Voting System and included in the 
documentation, they were not being submitted for certification in Texas. In short, the Texas 
Secretary of State was not provided with one coordinated set of documentation specific to the 
Texas examination and approval/certification process, and, furthermore, was provided with 
irrelevant information. It is Dominion's responsibility to prove (with details and not summary 
statements) that its voting system meets Texas standards; therefore, in future submissions, it 
would be helpful if Dominion would specifically state by reference to its documentation, source 
codes, etc. how its voting system meets Texas standards. 

2. AccuVote-OS (Precinct Count and Central Count). 

The Assure 1.3 Product Overview Guide dated May 7, 2012 states that the AccuVote-OS Central 
Count firmware is used for batch processing a large volume of AccuVote-OS ballots, such as 
absentee ballots. (However, its use is not limited to counting absentee ballots.) The Overview 
Guide goes on to state that a “complete system” is comprised of an AccuVote-OS ballot scanner 
installed with Central Count firmware and an optional AccuFeed ballot feeder. It should be 
noted that the "complete system" does not include a continuous feed printer dedicated to a real¬ 
time audit log. To the extent that Dominion represents that the AccuVote-OS device can be used 
as a central count device, I point out that 1 T.A.C. § 81.62 requires the use of a continuous feed 



printer dedicated to a real-time audit log if the AccuVote-OS is to be used as a central count 
device, and that such a component is not part of the AccuVote-OS "complete system." The 
examination did not test the AccuVote-OS as a central count device.^ 

We used a test deck of 16 ballots to test the AccuVote-OS as a precinct counter. Some of those 
ballots were marked with a black "Sharpie" that carefully colored in the entire oval. Other 
ballots were marked with pens, pencils, or a "Sharpie," and some of those marks were less than 
careful in how the oval was colored in. This was done because, while a "Sharpie" can be placed 
in every voting booth, the election workers cannot insure that a voter will actually use a 
"Sharpie," and there is no control over the instrument that a "ballot-by-mail" voter will use to 
mark his or her ballot. Then we compared the tabulation of the cast ballots produced in a printed 
“Election Summary Report” through OEMs with a manual hand count of the test deck. The 
manual count differed from the AccuVote-OS count of the ballots. It appears that there is some 
point at which the AccuVote-OS will not read a mark that a human being will and that, further, 
short of a post-election recount in accordance with Chapters 211-215 of the Texas Election 
Code, it will not be known whether the AccuVote-OS will read a marked ballot as a member of 
the precinct counting team would. 

I also note that the “Election Summary Reports” that were printed out were cutting out a small 
portion of the left hand side of the printing on the report. 

I suggest that if Dominion seeks approval/certification again of the AccuVote-OS that a 
substantially larger test deck be used to determine if the AccuVote-OS complies with the error 
rate standards of the voting system standards adopted by the Eederal Election Commission. 

3. PCS Central Count. 

According to Dominion's documentation, PCS is a high-speed, batch-ballot counting application 
used to control the scanning and processing of GEMS-generated ballots that is installed on the 
PhotoScribe, an AccuVote-OS ballot scanning workstation. During the examination, there were 
mechanical problems with the device on which PCS was installed. (I am unclear whether that 
device was a "PhotoScribe" or something else.) We used the same test deck of 16 ballots to test 
the PCS that had been used with the AccuVote-OS, and, again, the machine count results 
differed from the manual count. 

I suggest that if Dominion seeks approval/certification again of the PCS that a substantially 
larger test deck be used to determine if the PCS complies with the error rate standards of the 
voting system standards adopted by the Eederal Election Commission. I also suggest that 
Dominion explain why PhotoScribe with PCS does not need a continuous feed printer dedicated 
to a real-time audit log and how PhotoScribe with PCS fits into the voting system. 


Sec. 122.001. VOTING SYSTEM STANDARDS, (a) A voting system may not be used in an 
election unless the system: 

(1) preserves the secrecy of the ballot; 



(2) is suitable for the purpose for which it is intended; 

(3) operates safely, efficiently, and accurately and complies with the error rate standards of the 
voting system standards adopted by the Federal Election Commission; 

(4) is safe from fraudulent or unauthorized manipulation; 

(5) permits voting on all offices and measures to be voted on at the election; 

(6) prevents counting votes on offices and measures on which the voter is not entitled to vote; 

(7) prevents counting votes by the same voter for more than one candidate for the same office 
or, in elections in which a voter is entitled to vote for more than one candidate for the same office, prevents counting 
votes for more than the number of candidates for which the voter is entitled to vote; 

(8) prevents counting a vote on the same office or measure more than once; 

(9) permits write-in voting; 

(10) is capable of permitting straight-party voting; and 

(11) is capable of providing records from which the operation of the voting system may be 

audited. 

(b) A voting system may not be used in an election in which straight-party voting is permitted unless the 
system permits or prevents, as applicable, counting votes in accordance with Sections 65.007(c) and (d). 

(c) The secretary of state may prescribe additional standards for voting systems consistent with this title. 
The standards may apply to particular kinds of voting systems, to particular elements comprising a voting system, 
including operation procedures, or to voting systems generally. 

(d) (omitted) 

(e) For an election for federal office in which a state or federal court order has extended the time for 
voting beyond the time allowed by Subchapter B, Chapter 41, a voting system must provide a separate count of the 
votes cast after the time allowed by that subchapter. 

^ Sec. 122.032. REQUIREMENTS FOR APPROVAL GENERALLY, (a) For a voting system or 
voting system equipment to be approved for use in elections, the voting system in which the equipment is designed 
to be used must comply with the standards prescribed by Subchapter A. 

(b) The secretary of state may prescribe more specific requirements and standards, consistent with this 
code, for approval of particular kinds of voting system equipment or voting system equipment generally. 

^ Sec. 122.033. ADDITIONAL REQUIREMENTS FOR APPROVAL OF VOTING MACHINE. In 
addition to other requirements for approval, a voting machine must be equipped with; 

(1) a security system capable of preventing operation of the machine; 

(2) registering counters that can be secured against access; 

(3) a public counter; and 

(4) a protective counter. 

Sec. 122.0331. ADDITIONAL REQUIREMENTS FOR ELECTRONIC VOTING SYSTEM, (a) 
Copies of the program codes and the user and operator manuals and copies or units of all other software and any 
other information, specifications, or documentation required by the secretary of state relating to an approved 
electronic voting system and its equipment must be filed with the secretary. 

(b) Materials described by Subsection (a) that are not on file with and approved by the secretary of state, 
including any updated or modified materials, may not be used in an election. 

(c) The secretary of state shall periodically compare the materials on file with the materials actually used 
in elections to ensure compliance with this section. 

(d) The program codes and all other software on file with the secretary of state under this section are not 
public information. The materials shall be made available to the attorney general or the general's designee in any 
investigation of election irregularities. The materials may be made available in a judicial proceeding on the request 
of the court or other tribunal but may be viewed in camera only. 

^ (a) A voting system shall be accessible to voters with physical disabilities including no vision, low vision 
(visual acuity between 20/70 and 20/200, and/or 30 degree or greater visual-field loss), no hearing, low hearing, 
limited manual dexterity, limited reach, limited strength, no mobility, low mobility, or any combination of the 
foregoing (except the combination of no hearing and no vision, see subsection (b) of this section), by providing 



voters with physical disabilities with a practical and effective means to cast an independent and secret ballot in 
accordance with each of the following, assessed independently and collectively: 


(1) The voting system shall provide a tactile-input or speech-input device, or both; and 

(2) The voting system shall provide a method by which voters can confirm any tactile or audio input by having the 
capability of audio output using synthetic or recorded human speech, which is reasonably phonetically accurate; and 

(3) The voting system shall provide a means for a voter to change the voter's selection prior to the voter casting the 
ballot; and 

(4) Any operable controls on the input device that are needed for voters without vision shall be discernable tactilely 
without actuating the keys. (Note: All the buttons on the device would not have to be discernable tactilely, only 
those buttons that are actually required for the individual to use the "operation without vision" mode.); and 

(5) Any audio and non-audio access approaches shall be able to work both separately and simultaneously; and 

(6) If a non-audio access approach is provided, the system shall not require color perception; the system shall use 
black text or graphics, or both, on white background or white text or graphics, or both, on black background, unless 
the office of the Secretary of State approves other high-contrast color combinations that do not require color 
perception; and 

(7) Any voting system that requires any visual perception shall offer the election official who programs the system, 
prior to its being sent to the polling place, the capability to set the font size to a level that can be read by voters with 
low vision. (Note: Although there is no standard font size for this situation, a san-serif font of 18 points as printed on 
a standard 8.5 x 11 piece of paper will allow the most universal access.); and 

(8) The voting system shall provide audio information, including any audio output using synthetic or recorded 
human speech or any auditory feedback tones that are important for the use of the audio approach, through at least 
one mode (e.g., by handset or headset) in enhanced auditory fashion (i.e., increased amplification), and shall provide 
incremental volume control with output amplification up to a level of at least 97 dB SPL, with at least one 
intermediate step of 89 dB SPL; and 

(9) For transmitted voice signals, the voting system shall provide a gain adjustable up to a minimum of 20 dB with 
at least one intermediate step of 12 dB of gain; and 

(10) For the safety of others, if the voting system has the possibility of exceeding 120 dB SPL, then a mechanism 
shall be included to reset the volume automatically to a safe level after every use (e.g., when handset is replaced) but 
not before; and 

(11) If sound cues and audible information, such as "beeps" are used, there shall be simultaneous corresponding 
visual cues and information; and 

(12) If a non-audio approach is used in conjunction with an audio counterpart, any spoken text shall also be 
presented on screen, with the exception that any auditory confirmation of a voter's selection as required by 
subsection (b) of this section shall not be printed in text on the screen (Note: A graphic representation of a ballot 
with a check, "X," etc. beside a candidate or proposition is allowed.); and 

(13) All controls and operable mechanisms shall be operable with one hand, including with a closed fist, and 
operable without tight grasping, pinching, or twisting of the wrist; and 

(14) The force required to operate or activate the controls shall be no greater than 5 Ibf (pounds per square foot); and 

(15) If a forward approach by a person in a wheelchair to a voting system is necessary, the maximum high-forward 
reach allowed shall be 48 inches (1220 mm) and the minimum low-forward reach shall be 15 inches (380 mm). If 
the high-forward reach is over an obstruction, reach and clearances shall be as shown in the figure below or 
otherwise in accordance with the ADAAG, as written at the time the system is certified for use in the state of Texas; 
and 

(16) If a side or parallel approach by a person in a wheelchair to a voting system is necessary, the maximum side 
reach allowed shall be 54 inches (1370 mm) and the low side reach shall be no less than 9 inches (230 mm) above 
the floor. If the side reach is over an obstruction, reach and clearances shall be as shown in the figure below or 
otherwise in accordance with the ADAAG, as written at the time the system is certified for use in the state of Texas; 
and 

(17) The highest operable part of controls, dispensers, receptacles, and other operable equipment shall be placed 
within at least one of the reach ranges outlined in paragraphs (15) and (16) of this subsection. 

(b) Although we strongly encourage voting system vendors to strive to develop systems that will provide a secret 
ballot for all individuals, this office recognizes that the technology available at the time of the adoption of this 
section will not accommodate voters who have a combination of no hearing and no vision. A voting system may be 



considered accessible and in compliance with state law without allowing voters with a combination of no hearing 
and no vision to cast a secret ballot. 


® In its Form 101 relating to the AccuVote-OS voting system, Dominion states in response to question 
(13), "Is capable of producing a real-time audit log (Texas Administrative Code (TAC) § 81.62)," "Not applicable to 
this device." 



